cloud▌

HTTP API access to CloudBase platform features including database, authentication, functions, storage, and hosting. \n \n Supports MySQL RESTful API for CRUD operations on database tables via GET, POST, PATCH, DELETE endpoints with field selection, filtering, pagination, and sorting \n Requires authentication via AccessToken (user permissions), API Key (admin permissions), or Publishable Key (anonymous access); tokens passed in Authorization header \n Provides unified domain endpoints for domest

Build optimized, secure multi-stage Dockerfiles for any language or framework. \n \n Structures builds with separate builder and runtime stages, copying only necessary artifacts to minimize final image size and attack surface \n Emphasizes layer caching optimization by ordering commands from least to most frequently changing, combined with .dockerignore and command consolidation \n Recommends minimal base images (Alpine, distroless, or official slim variants) with exact version pinning for repro

End-to-end deployment, evaluation, and lifecycle management for Microsoft Foundry agents. \n \n Covers the complete agent development lifecycle: create, deploy (Docker build, ACR push), invoke, evaluate, optimize prompts, and troubleshoot \n Organized into specialized sub-skills for deploy, invoke, observe (evaluation and prompt optimization), trace, troubleshoot, and dataset curation from production traces \n Supports both prompt-based agents (LLM-backed) and hosted agents (container-based cust

### offensive-cloud - Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, i - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

Routes NVIDIA Nemotron Speech (Riva) NIM tasks — deploys, runs, and tests ASR, TTS, and NMT NIMs on build.nvidia.com or self-hosted.

Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.

Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.

Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.

Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.

Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment". Do NOT use for deploying to Netlify, Cloudflare, or Render (use their respective skills).